基于主成分分析和学习矢量量化的会话初始协议识别研究

Research on Session Initiation Protocol Identification Based on Principal Component Analysis and Learning Vector Quantization

针对加密会话初始协议(SIP)识别困难以及相关研究工作较少,对入侵检测、网络流量监控等工作带来不便的问题,提出基于主成分分析(PCA)和学习矢量量化(LVQ)网络的SIP协议识别模型。通过对SIP协议的网络流特征进行PCA,提取出累计贡献率高于85%的相关流特征作为SIP协议识别过程中的主要特征,并进行LVQ网络训练,构建出完整的SIP协议识别模型。实验结果表明,PCA_LVQ模型对SIP协议的识别率均高于90%,通过PCA提取的SIP协议网络流属性区别于非SIP协议的属性,该模型对SIP协议的识别效果较好。

The encrypted Session Initiation Protocol（SIP） is difficult to identify and there is less related research,which makes the intrusion detection and the network traffic monitoring inconvenient.Aiming at these problems,this paper proposes a SIP identification model based on Principal Component Analysis（PCA） and Learning Vector Quantization（LVQ） network.It extracts the feature of relevant flow characteristics,the cumulative contribution rate of which is higher than 85%,as the main characteristic during the identification of SIP by adopting PCA on the network traffic properties of the SIP.Then it trains the LVQ network training and builds a complete SIP identification model.Results show that the PCA_LVQ model can identify the SIP with a recognition rate higher than 90%,indicating that the property of SIP extracted by PCA network flow is different from non-SIP.The model has good effect on identifying SIP.